The following table shows the required network settings of Industrial Edge.
Customers need to apply ingress and egress rules in their firewalls to ensure the required connectivity between all Industrial Edge components:
Port
Protocol
Direction
IEM Offering
Usage
443
HTTPS
Ingress
IEM OS, IEM Pro, IEM Virtual, IEM Cloud
Industrial Edge Hub UI
2020
SSH
Egress
IEM OS
Remote support channel for the IEM
Port
Protocol
Direction
IEM Offering
Usage
123, UDP
NTP
Egress
IEM OS, IEM Pro, IEM Virtual, IEM Cloud
Network time synchronization
123, UDP
NTP
Ingress
Only relevant for IEM OS or IEMV if used as an NTP server. Optional feature
Network time synchronization, acting as server in IEM OS.
53, UDP
DNS
Egress
IEM OS, IEM Pro, IEM Virtual, IEM Cloud
Domain name resolution
80
HTTP
Ingress
IEM Virtual
Redirection to port 4443
443
HTTPS
Ingress
IEM OS, IEM Pro, IEM Virtual, IEM Cloud
IE Management UI
4443
HTTPS
Ingress
IEM Virtual
Initial setup UI. Service & Maintenance UI
9443, 9444
HTTPS
Ingress
IEM OS
IE Management UI
2020
SSH
Egress
IEM OS
Remote support channel for IEM OS.
9100, TCP
HTTP
Egress
IEM Virtual
Performance metrics for IEM Virtual (only when enabled)
Remote access for Edge Devices, port can differ depending on the device builder.
50051
gRPC
Egress
All
Enabling dynamic service discovery, integration, and management across distributed applications
53
DNS
Egress
All
DNS (Domain Name System) is crucial when Industrial Edge Devices need to resolve domain names into IP addresses. This functionality is especially important for accessing services such as the Industrial Edge Management Cloud.
Port
Protocol
Direction
IEM Offering
Usage
443
HTTPS
Egress
IEM OS, IEM Pro, IEM Virtual, IEM Cloud
IE Management UI
9443
HTTPS
Egress
IEM OS
IE Management UI
Port
Protocol
Direction
IEM Offering
Usage
32500
SSH
Ingress
IEM OS
Remote access for Edge Devices
The following figure shows data traffic and the involved ports as an example:
For the IEM, IP-based or DNS-based operation is determined during the setup and cannot be changed afterwards.
With an IP-based setup, the self-generated certificates from the IEM are always used.
With a DNS-based setup, user-generated certificates are possible and mandatory.
IEDs are always being onboarded using self-generated certificates from the IEM.
These certificates can be exchanged with user-generated certificates.
The IEM certificates cannot be restored.
IE component
IP-based setup
DNS-based setup
IEM Offering
Remark
IEM
https://<IP>/
https://<IEM-name>/
IEM OS, IEM Virtual
-
IEM-Registry
https://<IP>/v2/
https://<IEM-registry>/v2/
IEM OS
Must be accessible for all connected IEDs
IED
https://<IP>:443
https://<IED-name>:443
-
If DNS is used, name must be included in certificate
For older VM based IEM setup you can refer these URLs.
IE component
IP-based setup
DNS-based setup
IEM Offering
Remark
IEM OS
https://<IP>:443
-
IEM OS
DNS not possible
IEMA
https://<IP>:9443
https://<IEM-name>:443
IEM OS
-
IEM-Registry (For ISO based IEM)
https://<IP>:9444
https://<IEM-registry>:443
IEM OS
Must be accessible for all connected IEDs
IED
https://<IP>:443
https://<IED-name>:443
-
If DNS is used, name must be included in certificate
